Re: [PATCH] netfilter: ctnetlink: validate expect class against master helper

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Mon, Mar 30, 2026 at 12:51:31AM +0800, Qi Tang wrote:
> ctnetlink_alloc_expect() validates CTA_EXPECT_CLASS against the
> helper specified by CTA_EXPECT_HELP_NAME.  However,
> __nf_ct_expect_check() and nf_ct_expect_insert() later index the
> expect_policy array using the master conntrack's actual helper.
> 
> When the supplied helper has a larger expect_class_max than the
> master's helper, the class passes validation but produces an
> out-of-bounds read on the master helper's heap-allocated policy
> array during expectation insertion.
> 
> Validate the class against the master conntrack's own helper
> instead, since that is the helper whose policy array will actually
> be indexed.
> 
>   BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0
>   Read of size 4 at addr ffff8880043fe408 by task poc/102
>   Call Trace:
>    nf_ct_expect_related_report+0x2479/0x27c0
>    ctnetlink_create_expect+0x22b/0x3b0
>    ctnetlink_new_expect+0x4bd/0x5c0
>    nfnetlink_rcv_msg+0x67a/0x950
>    netlink_rcv_skb+0x120/0x350

Better to ignore the helper name proposed by userspace when creating
the expectation.

The master conntrack must already has a helper, and such helper must
be the same that is specified here.

I could instead validate that exp->helper == nfct_help(master)->help->helper
but it is not worth, this fix simplifies this interface.

CTA_EXPECT_HELP_NAME still is used for dumping the name.

See:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260330115236.882409-1-pablo@netfilter.org/